The Office for Personal Data Protection ('GPDP') published, on 30 December 2021, its decision, as issued on 9 December 2021, in which it fined two real estate agencies, for violations of Articles 6 and 11 of the Personal Data Protection Act (Act 8/2005) ('PDPA'), following complaints from data subjects regarding unsolicited direct marketing by the real estate agencies.

Background to the case

In particular, the GPDP outlined that it had received complaints from data subjects regarding employees of the real estate agencies who had been calling data subjects without reason.

Findings of the GPDP

More specifically, the GPDP outlined that it had identified two breaches by the real estate agencies.

Firstly, the GPDP identified that the real estate agencies did not obtain the unequivocal consent of data subjects before carrying out the telemarketing activities, and further that the processing of personal data was not pursuant to the performance of a contract agreed between the data subjects and the real estate agency. Accordingly, the real estate agencies were found to have violated Article 6 of the PDPA in that the processing personal data was not legitimate.

In addition, the GPDP outlined that the real estate agencies had not clearly communicated both the personal data that needed to be processed and how the data had been obtained, thereby violating Article 11 of the PDPA on data subjects right of access. Furthermore, the GPDP noted that one of the real estate agencies had not respected the data subjects' right to object, after failing to take action following data subjects' objections to receiving unsolicited telemarketing calls.

Outcomes

In view of the above, the GPDP imposed fines of MOP 14,000 (approx. €1,580) and MOP 30,000 (approx. €3,300), and highlighted a sanction on one real estate agency to remove from computer systems all personal data of affected data subjects.

You can read the decision, only available in Portguese, here.